Privacy Policy

What this policy covers

This policy covers this website and the hosted demo instance you can sign in to. It does not — and cannot — cover an AskDocs instance that you install and run yourself.

That distinction is the most important thing on this page, so it is worth stating plainly rather than burying:

When you self-host AskDocs, you are the data controller. Your documents, your users and your logs are yours. We have no access to them, no copy of them, and no way to obtain them.

What a self-hosted instance sends us

Nothing. There is no telemetry, no usage counter, no licence check, no crash reporter and no update ping. A self-hosted AskDocs instance makes no outbound request to us of any kind, and can run fully air-gapped.

We do not know how many instances exist, who runs them, or what is in them. This is not a promise about our intentions — it is a property of the code, and you can verify it by reading the source or by watching an air-gapped install fail to reach for the network.

The one thing that does leave, if you configure it

If you point your instance at a hosted language model rather than a local one, then on every question your instance sends that provider your question text and the passages retrieved from your documents. That traffic goes from your server to that provider under their terms — it does not pass through us.

This is a choice you make in configuration, and running a local model avoids it entirely. We disclose it here because most products in this category do not.

What this website collects

The contact form

If you use the contact form, we receive the name, email address, subject category and message you type. We use them to answer you and for nothing else. We do not add you to a mailing list, and there is no mailing list to add you to.

Server logs

Our host records standard web-server request data — IP address, timestamp, the page requested, and your browser's user-agent string. These are generated by the hosting infrastructure to serve the site and to detect abuse. We do not use them to build a profile of you.

Analytics

At the time of writing, this site runs no analytics at all. When analytics are added they will be a privacy-preserving, cookieless tool that collects no personal data and sets no identifiers — and this section will be updated to name the tool on the day it ships, not afterwards.

Cookies

This website sets no cookies. There is no consent banner because there is nothing to consent to.

The hosted demo instance

Signing in to the demo at askdocs.vivechana.org creates an account and stores what you upload, so that AskDocs can index it and answer questions about it. Treat the demo as a demonstration: do not upload confidential, personal or regulated documents to it. If your documents are sensitive, that is precisely the case for self-hosting.

Demo data may be reset without notice. You can delete your account from within the application, which removes your documents and conversations.

Third parties

The services this website depends on:

• Hosting. The site is served by a static hosting provider, which processes request data as described above.
• Fonts. Typefaces are currently loaded from Google Fonts, which means your browser makes a request to Google to fetch them and Google sees your IP address. We are moving to self-hosted font files, after which this dependency disappears and this bullet goes with it.
• The contact form handler. Form submissions are delivered by a third-party form service or our own mail infrastructure; either way the recipient is us.

We use no advertising networks, no tracking pixels, no session recorders and no social media embeds.

How long we keep things

• Contact messages — kept while the conversation is live and for a reasonable period afterwards, then deleted.
• Server logs — kept for a short period by the host for operational and abuse-detection purposes.
• Demo accounts — kept until you delete the account or the demo is reset.

Your rights

You can ask us what personal data we hold about you, ask us to correct it, or ask us to delete it. Because the only personal data we hold about most people is an email thread they started, these requests are usually simple to honour.

For a self-hosted instance, these requests go to whoever operates that instance — not to us. We have nothing to hand over.

Security

How to report a vulnerability, and an honest account of what the current release does and does not protect, are on the security section. Contact details are also published at /.well-known/security.txt.

Changes to this policy

If this policy changes, the date at the top of the page changes with it. We will not quietly broaden what we collect and leave the date alone.

Contact

Privacy questions go to info@idefender.io, or through the contact form — choose General, or Security if the question concerns a vulnerability.